CloudWatch log group meets the minimum retention period

Check ID: cloudwatch_log_group_retention_policy_specific_days_enabled
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: AwsLogsLogGroup

What this check verifies

CloudWatch Log Groups are assessed for a retention period at or above the configured threshold (e.g., 365 days) or for being set to never expire. Log groups with shorter retention are identified.

Risk

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Recommendation

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws logs put-retention-policy —log-group-name <LOG_GROUP_NAME> —retention-in-days <DAYS>

# Set retention on a CloudWatch Log Group
resource "aws_cloudwatch_log_group" "<example_resource_name>" {
  name              = "<example_resource_name>"
  retention_in_days = <DAYS> # Critical: set to at least the required minimum to pass the check
}

# CloudFormation: set retention on a CloudWatch Log Group
Resources:
  <example_resource_name>:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: "<example_resource_name>"
      RetentionInDays: <DAYS>  # Critical: sets log retention to the required minimum to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_group_retention_policy_specific_days_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudWatch Log Group is not publicly accessible Metric filter and alarm exist for AWS Config changes

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires